# omidfleet_box — VPS disaster-recovery snapshot

This private repo mirrors the important pieces of `omid-fleet` (Hetzner CCX33 VPS) so a full box wipe is recoverable. Nightly cron on the VPS refreshes the tree via `scripts/sync.sh` and force-pushes to `main`.

## What's here

Filesystem-mirror layout so restore is a straightforward directory copy:

```
data/cameron/
├── vault/               ← /data/cameron/vault  (fleet-canonical knowledge)
├── life/                ← /data/cameron/life   (personal KB, notes, life projects incl. persian app source)
└── para/.agents/        ← /data/cameron/para/.agents  (serve.py + agent reports + omidlab.net app)

home/cameronsmith/
├── .cloudflared/config.yml   ← cloudflared tunnel config (credentials.json NOT included)
├── memory/                    ← ~/.claude/projects/-data-cameron-agents-stuff/memory (manager memory)
├── scripts/                   ← any user-scripts
└── crontab.txt                ← current crontab snapshot

phe/                     ← reserved for phe-side code after Saturday's migration
```

## What's NOT here (and why)

- **`~/.ssh/` (keys)** — private keys should never leave the machine. Regenerate a new keypair on restore + re-authorize.
- **`~/.cloudflared/*.json` credentials** — contains the tunnel cert secret. Recover from Cloudflare dashboard.
- **`.env` files across all projects** — API keys (ANTHROPIC, ELEVENLABS, etc.) are gitignored. Restore from a secure keystore.
- **agents_stuff/.git/** — that's its own repo at `cameronosmith/agents_stuff`; content only, no history.
- **vault/.git/** — same reason: vault has its own local git repo; content only.
- **venvs, `__pycache__`, `node_modules/`** — regenerable.
- **Persian TTS audio cache** (`life/projects/persian/static/audio/*.mp3`) — regenerated on demand.
- **Session JSONLs** (`~/.claude/projects/*/*.jsonl`) — huge and regenerable via save_scrollback + resume_fleet.
- **sshfs mount contents** — those are on other hosts (phe, puget, yukon).

## Restore procedure

On a fresh VPS (after `01_vps_bootstrap.sh` from `agents_stuff/migration/`):

```bash
# 1. clone this
git clone git@github.com:cameronosmith/omidfleet_box.git ~/omidfleet_box
cd ~/omidfleet_box

# 2. rsync each mirrored dir back to its home
sudo rsync -av data/cameron/vault/            /data/cameron/vault/
sudo rsync -av data/cameron/life/             /data/cameron/life/
sudo rsync -av data/cameron/para/.agents/     /data/cameron/para/.agents/
rsync -av      home/cameronsmith/.cloudflared/config.yml  ~/.cloudflared/config.yml
rsync -av      home/cameronsmith/memory/      ~/.claude/projects/-data-cameron-agents-stuff/memory/
rsync -av      home/cameronsmith/scripts/     ~/scripts/
crontab home/cameronsmith/crontab.txt

# 3. restore secrets (from your secure keystore — not this repo):
#    - ~/.ssh/id_ed25519 (private) + register pubkey with GitHub/lab
#    - ~/.cloudflared/<tunnel_id>.json (from Cloudflare dashboard)
#    - .env files in vault + persian project (API keys)

# 4. clone agents_stuff (its own repo)
git clone git@github.com:cameronosmith/agents_stuff.git /data/cameron/agents_stuff

# 5. run resume_fleet
cd /data/cameron/agents_stuff && ./resume_fleet.sh
```

## Sync mechanics

`scripts/sync.sh` runs nightly from `cameronsmith`'s crontab. Uses `rsync -a --delete` from source paths into this repo's mirror layout, respecting `.gitignore` via `--filter=':- .gitignore'` at each source root. Then `git add -A && git commit && git push origin main`. Logs to `~/.cache/omidfleet_box_sync.log`.

If the sync fails or would push secrets (pre-push grep guard), it aborts and notifies the manager tmux pane instead of pushing.

## Adding phe content

Reserved directory `phe/` in the repo layout is empty. Saturday's post-migration script will populate it with:

```
phe/data/cameron/para/robot/yam/    ← yam-v4 model code + baselines + viz + eval
phe/data/cameron/repos/             ← other lab-canonical repos
```

Same nightly cron will push updates.